5 ms·

So instead of gently decreasing security when it's not possible to be totally secure... it's better to throw the baby out with the bathwater. Wonderful.

wutbrodo 11y ago
Exactly. One of the first things we learned in my UNDERGRAD security class is that "good" security which is unduly onerous will just make users route around it and revert to plain old bad security. The canonical example was ridiculous password requirements which just make people put their password on a post it on their monitor. As you said, security requirements that are that onerous and too rigid to relax when necessary is just shittily designed security to begin with.
- knodi123 11y ago
  > "good" security which is unduly onerous will just make users route around it and revert to plain old bad security I believe this picture is also a suitably canonical example. http://www.jumpoverthere.com/wp-content/uploads/2012/10/security.jpg http://www.jumpoverthere.com/wp-content/uploads/2012/10/secu...
knowaveragejoe 11y ago
I imagine that's easier said than done in some scenarios, perhaps even the majority.
- maxxxxx 11y ago
  A lot of security guys just ignore legitimate needs. It may be difficult but they can't just say "No" to everything.
noxToken 11y ago
The gist of a convo with IT when I needed to work around some parameters: "Hey IT dept. I understand the reason for our network restrictions, but we have a lot of data that we need to get to [some endpoint] using [some method]." "Sorry, we can't relax the restrictions. You have to work within the parameters." "But the parameters do not allow me to complete my job." "Sorry." I'd love to work within the parameters, but when IT won't budge, you're stuck with the least preferrable method.
- protomyth 11y ago
  and where exactly is your boss during this time?
  - noxToken 11y ago
    Right beside me infuriated, because there was nothing that he could do about it either.
    - protomyth 11y ago
      That's not an IT issue, that's an organizational issue. If your boss cannot do anything including appeal to his/her boss, then you shouldn't do anything. That type of thing needs to be sorted out. Clearly, in the case of the F-35 systems, federal law was violated doing the offsite thing. We see developers (and frankly some sysadmins) violating HIPA and this kind of stuff has to stop.
      - noxToken 11y ago
        >That's not an IT issue, that's an organizational issue. I knew this at the time. I never blamed IT directly for the issues, because I knew that they were just doing their job as well.
        tremon 11y ago
        I know it's not the easiest thing to do, but the proper response is to walk to HR (with your boss alongside) and explain that you can't do your job. The improper response is to wardrive to the first open access point you can find and use that.
        maxxxxx 11y ago
        In theory you are right but that's not how it works in most places.
        11y ago
craigyk 11y ago
Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. If that person's action results in a leak than they can be personally sued and fined. Doesn't matter if they did it out of frustration with obstacles that made it very difficult to "get stuff done".
- protomyth 11y ago
  > Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. I don't think your wrong, but an awful lot of system admins have ended up dealing with lawyers and courts. Your system admin having had a prior talk with the lawyers about security, HIPA, and who is liable will do wonders for their willingness to bend the rules for you.
  - officialchicken 11y ago
    Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself. According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it's non-cleartext. So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.

wutbrodo 11y ago

Exactly. One of the first things we learned in my UNDERGRAD security class is that "good" security which is unduly onerous will just make users route around it and revert to plain old bad security. The canonical example was ridiculous password requirements which just make people put their password on a post it on their monitor. As you said, security requirements that are that onerous and too rigid to relax when necessary is just shittily designed security to begin with.

knodi123 11y ago
> "good" security which is unduly onerous will just make users route around it and revert to plain old bad security I believe this picture is also a suitably canonical example. http://www.jumpoverthere.com/wp-content/uploads/2012/10/security.jpg http://www.jumpoverthere.com/wp-content/uploads/2012/10/secu...

knowaveragejoe 11y ago

I imagine that's easier said than done in some scenarios, perhaps even the majority.

maxxxxx 11y ago
A lot of security guys just ignore legitimate needs. It may be difficult but they can't just say "No" to everything.

noxToken 11y ago

The gist of a convo with IT when I needed to work around some parameters: "Hey IT dept. I understand the reason for our network restrictions, but we have a lot of data that we need to get to [some endpoint] using [some method]." "Sorry, we can't relax the restrictions. You have to work within the parameters." "But the parameters do not allow me to complete my job." "Sorry." I'd love to work within the parameters, but when IT won't budge, you're stuck with the least preferrable method.

protomyth 11y ago
and where exactly is your boss during this time?
- noxToken 11y ago
  Right beside me infuriated, because there was nothing that he could do about it either.
  - protomyth 11y ago
    That's not an IT issue, that's an organizational issue. If your boss cannot do anything including appeal to his/her boss, then you shouldn't do anything. That type of thing needs to be sorted out. Clearly, in the case of the F-35 systems, federal law was violated doing the offsite thing. We see developers (and frankly some sysadmins) violating HIPA and this kind of stuff has to stop.
    - noxToken 11y ago
      >That's not an IT issue, that's an organizational issue. I knew this at the time. I never blamed IT directly for the issues, because I knew that they were just doing their job as well.
      - tremon 11y ago
        I know it's not the easiest thing to do, but the proper response is to walk to HR (with your boss alongside) and explain that you can't do your job. The improper response is to wardrive to the first open access point you can find and use that.
        maxxxxx 11y ago
        In theory you are right but that's not how it works in most places.
        11y ago

craigyk 11y ago

Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. If that person's action results in a leak than they can be personally sued and fined. Doesn't matter if they did it out of frustration with obstacles that made it very difficult to "get stuff done".

protomyth 11y ago
> Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. I don't think your wrong, but an awful lot of system admins have ended up dealing with lawyers and courts. Your system admin having had a prior talk with the lawyers about security, HIPA, and who is liable will do wonders for their willingness to bend the rules for you.
- officialchicken 11y ago
  Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself. According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it's non-cleartext. So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.